Add migration docs and fix notarization scripts to use inline credentials

Keychain profile approach doesn't work from Galaxy terminal (no interactive
auth entitlement). Switched to inline Apple ID/team/password in notarize.sh
and package.sh. Added migration-docs/ for session continuity on new machines.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

migration-docs/conversation-transcript.md

@@ -0,0 +1,91 @@
+# Conversation Transcript — 2026-07-08 / 2026-07-09
+
+## Session Start
+
+George activated minion mode. Session startup:
+- Checked conversation logs, memory systems, tasks — no active tasks
+- Last session was May 13-14 (2 month gap)
+- Set up hourly doc-sync cron (job `b3d95f3a`, fires at :17)
+
+## Task 1: Pull Latest Code
+
+**George:** "pull the latest code"
+
+- Ran `git stash -u -- Cargo.lock` (modified Cargo.lock in working tree)
+- `git pull --ff-only` — fast-forwarded from `840bc4d` to `40bd86f6` (3,893 files updated)
+- Major changes: rebase-with-warp merge, OpenAI/LiteLLM support, Bedrock crash logging
+- Cargo.lock stash had conflict with upstream — resolved by taking upstream version (`git checkout -- Cargo.lock`)
+- New remote branch: `feat/warp-parity`, new tags: `v1.6.2`, `v1.6.3`
+
+## Task 2: Build Release
+
+**George:** "how to build"
+
+Provided build commands:
+```bash
+cargo run                                    # Dev run
+cargo bundle --bin galaxy-oss --package galaxy  # Bundle .app
+./build-debug.sh                             # Full debug DMG
+./build-release.sh                           # Full release DMG
+./script/presubmit                           # fmt + clippy + tests
+```
+
+**George:** "build release failed"
+
+Ran `./build-release.sh` — compiled and signed successfully but hung at notarization.
+
+**Root cause:** Keychain profile `notarytool-profile` was gone (keychain reset since May session).
+
+Attempted to store credentials:
+```bash
+xcrun notarytool store-credentials notarytool-profile \
+  --apple-id g.brancovici@samsung.com \
+  --team-id 3JU72Z7Y3J \
+  --password cowi-fved-uajk-arsk
+```
+
+Failed with "HTTP 401 Invalid credentials" when using Samsung password directly. Needed app-specific password.
+
+**George provided app-specific password:** `cowi-fved-uajk-arsk`
+
+Credentials validated but `store-credentials` failed with "User interaction is not allowed" — Galaxy terminal can't write to keychain (no interactive auth entitlement).
+
+Tried `security unlock-keychain` — still failed. The issue is `notarytool` needs a macOS security dialog that non-standard terminals can't show.
+
+**Solution:** Modified scripts to use inline credentials instead of keychain profile:
+- `notarize.sh` — replaced `--keychain-profile notarytool-profile` with `--apple-id`/`--team-id`/`--password`
+- `package.sh` — same change
+
+**Result:** Full `./build-release.sh` completed successfully:
+- Compile: OK (release profile, 1.89s — was cached)
+- Bundle: Galaxy.app created
+- Sign: Developer ID Application: SAMSUNG ELECTRONICS AMERICA, INC. (3JU72Z7Y3J)
+- Notarize app: Accepted (submission `04c80ce4-b4de-4ffa-81f7-63e4b80299ee`)
+- Create DMG: OK (hdiutil, one retry needed for "Resource busy")
+- Sign DMG: OK
+- Notarize DMG: Accepted (submission `ce8e821f-3898-488f-9370-f5d67e617ec5`)
+- Staple: OK
+- Output: `target/release/bundle/osx/Galaxy.dmg`
+
+## Task 3: Clean Build Instructions
+
+**George:** "I need to run the build script myself fresh. how do I clean up everything before that?"
+
+Provided:
+```bash
+# Just remove bundle output (quick):
+rm -rf target/release/bundle/osx/Galaxy.app target/release/bundle/osx/Galaxy.dmg
+
+# Full recompile (slower, ~2 min):
+cargo clean --release
+```
+
+## Task 4: Migration Docs (current)
+
+**George:** "create a folder migration-docs..."
+
+Creating this migration package.
+
+## Hourly Doc Syncs
+
+Multiple hourly cron fires occurred throughout the session. All reported "no updates needed" after the initial sync that created the conversation log and active-work.md.